Deployment Architecture

Database performance impact due to DB Connect

sgupta80
Engager

Hi,

Since DB Connect has abilities to run queries against a database and access schemas, what sort of performance impact could I expect on my Postgresql database? I will be exposing my standby database to DB Conenct, but it could slow down certain processes like db replication on that database right? Wouldn't an ETL layer be beneficial in this regard?

Dan
Splunk Employee
Splunk Employee

There's a section in the docs about performance.

http://docs.splunk.com/Documentation/DBX/1.0.8/DeployDBX/Otherdeploymentconsiderations#Performance_c...

Because Splunk DB Connect queries your database, there is a possiblity that your queries may impact that database's performance. In particular, if the initial run of your query to the database retrieves a lot of data, this may affect the performance of your database. Subsequent runs of the query should generally be less impactful, as they are only retrieving data that is new since the previous run of the query. To mitigate this, you can set the tail.follow.only directive, which is only exposed in inputs.conf.

Lookups generate multiple selects that should be within the expected workload for a database and should not affect performance. Splunk DB Connect will execute a separate SELECT statement for each unique combination of input fields. This may happen more than once per search, because the search preview function in Splunk may invoke the lookup multiple times during execution of a search for parts of the results. Splunk will not cache the results between invocations of the lookup.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...